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Researchers, policymakers and law enforcement agencies across the globe struggle to find effective strategies 
to control criminal networks. The effectiveness of disruption strategies is known to depend on both network 
topology and network resUience. However, as these criminal networks operate in secrecy, data-driven 
knowledge concerning the effectiveness of different criminal network disruption strategies is very limited. 
By combining computational modeling and social network analysis with unique criminal network 
intelligence data from the Dutch Police, we discovered, in contrast to common belief, that criminal networks 
might even become 'stronger', after targeted attacks. On the other hand increased efficiency within criminal 
networks decreases its internal security, thus offering opportunities for law enforcement agencies to target 
these networks more deliberately. Our results emphasize the importance of criminal network interventions 
at an early stage, before the network gets a chance to (re-)organize to maximum resilience. In the end 
disruption strategies force criminal networks to become more exposed, which causes successful network 
disruption to become a long-term effort. 

Organized crime forms a great threat to societies across the globe. International criminal drugs organiza- 
tions try to infiltrate legal businesses and governments, infecting economic branches with corruption 
and violence. Moreover upcoming threats like cybercrime, child porn, maritime piracy, match fixing and 
identity theft cause substantial harm and ask for proactive interventions to control the criminal organizations 
behind them'-^. Government and law enforcement agencies worldwide seek ways to disrupt these criminal 
organizations effectively, preferably at an early stage. Over the past decade a growing number of studies emerged 
that provide empirical evidence of the use of social network analyses to get a better understanding of organized 
crime. These studies show that criminal organizations need to be considered as social networks that form 
collectives rather than organizations with unique features, such as flexible and non-hierarchical internal rela- 
tions^"". This approach has serious implications for the way we think about law enforcement control of organized 
crime. It has long been assumed that targeting the 'kingpin' leader at the top of the pyramid structured mafia 
organization, would result in the coUapse of the entire criminal organization'' '"'. However, new insights from 
social network analyses emphasize that the fluidity and flexibility of the social structure of criminal networks 
makes them highly resilient against these traditional law enforcement strategies^''". For instance, it was found that 
even though a drug trafficking network was structurally targeted over a substantial period of time, the trafficking 
activities continued and its network structure adapted". Research concerning the resilience of criminal networks 
involved in the production of ecstasy in the Netherlands lead to the same conclusions'". How can this be 
explained? 

The complexity of criminal networks. An answer to this question can be found within the specific features of the 
associated 'dark' network structures and, more importantly, the conditions under which these exist'^ '^. Criminal 
network structures are known to be very complex systems. As MorseUi describes it "Criminal networks are not 
simply social networks operating in criminal contexts. The covert settings that surround them call for specific 
interactions and relational features within and beyond the network"^. Criminal networks therefore differ from 
legal networks in that they face a constant trade-off between security and efficiency which directly affects its 
network structure'-'. On the one hand illegal activities need to stay concealed from the government or criminal 
competition. This means that direct communication between co-conspirators concerning illegal activities needs 
to be restricted to a minimum. On the other hand risks have to be taken in times of action, often demanding highly 
efficient communication and trust among the participants'^''''. Criminal networks therefore continuously balance 
between efficiency and security according to the given circumstances of the illegal activities. 
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This trade-off has a direct effect on its network structure as 
revealed by a study from Baker and Faulkner'^. They found that 
within a covert network, involved in a price-fixing scheme, the most 
important actors deliberately operated from the peripheries of the 
network, thus protecting these essential players from immediate 
detection after government intervention. In addition, Morselli et al. 
found that the balance between efficiency and security within covert 
networks was influenced by its network objective. They compared 
the structure of a criminal network with terrorist networks and 
showed that criminal networks need more efficiency in their direct 
lines of communication as compared to terrorist networks. 
Consequently this made them less secure and more vulnerable to 
disruption". This can be explained by the fact that economically 
driven criminal networks need shorter time frames between action 
(time-to-task) as opposed to ideologically driven terrorist networks. 
Terrorist networks might achieve their goals by just one successful 
terrorist attack. Criminal networks are often action oriented, result- 
ing in higher levels of risk of becoming detected. In response, crim- 
inal networks try to remain flexible and agile. This flexibility gives 
them the ability to adapt quickly to external shocks' ". 

Although these studies help us to understand that remaining flex- 
ible is the key to criminal network resilience against disruption, little 
is known about how these flexible network structures actually 
recover from an attack and continue their illegal activities. In other 
words: What actually makes these flexible criminal network struc- 
tures so difficult to disrupt? In search for an answer, we first need to 
understand that like every social network, criminal networks are not 
static, but dynamic in nature''^. Criminal networks can change for 
several reasons: as a result of new business opportunities, as a con- 
sequence of competition that requires a defensive orientation or as a 
direct result of law enforcement controls that may lead to the down- 
fall, stagnation or adaptation of the network'. The changing effects of 
network disruption can therefore only be understood within its 
dynamics, these networks are truly complex adaptive systems'^. 
Many researchers of criminal networks agree that "studying . . . the 
dynamics in criminal networks is probably the most challenging obs- 
tacle facing anyone approaching this arear^'' Although we recognize 
the complexity and difficulty that is associated with studying change 
within social networks, we attempt to capture these dynamics within 
a computational framework. 

Research aim. The aim of this study is twofold. The first aim is to 
unravel the dynamics of the interaction between disruption and 
resilience within criminal networks. Understanding these 
dynamics might have major implications for the way we think 
about control strategies aimed at organized crime. The second aim 
is to find the most effective criminal network disruption strategy 
according to this model, by simulating the effects of different 
network disruption strategies on network topology. We combine 
methods of computational modeling and social network analysis to 
simulate the behavior of a criminal network involved in organized 
cannabis cultivation based on intelligence data from the Dutch 
Police. 

Organized cannabis cultivation as a criminal network problem. 

Organized cannabis cultivation is one of the growing problems 
concerning international organized crime throughout different 
continents'""^'. Recent studies show that cannabis cultivation is 
associated with the use of more sophisticated methods, from 
outdoor cannabis sites towards sophisticated indoor settings. A 
Dutch study based on a study of 19 closed police investigations 
reveals that cannabis cultivation is a hard crime, involving extreme 
violence and mutual rip-offs and is rapidly expanding interna- 
tionally^^. Different studies concerning cannabis cultivation reveal 
expanding co-operations between criminal networks from Belgium, 
the Netherlands, Germany and the UK^^'^'. Outside the EU these 
trends are also observed within Canada and the US^". These trends 



of worldwide expansion and increased levels of sophistication and 
violence, indicates that cannabis cultivation involves professional 
criminal cooperation with many roles and functions. 

Although different countries recognize organized cannabis cul- 
tivation as a serious problem, different studies show that law enforce- 
ment efforts do not seem to have reduced the problem'"'^^'^''. Current 
interventions show no significant effect on large-scale growers, 
although proximately 6000 cannabis cultivation sites are being dis- 
mantled annually. A first reason is that thorough investigations of the 
criminal networks behind large-scale cannabis cultivation are extre- 
mely time-consuming and costly". Secondly law enforcement inter- 
ventions in for instance The Netherlands aimed at cannabis 
cultivation can be described as a hit-and-run practice, busting a 
maximum number of sites with maximum efficiency without paying 
attention to the potential impact on the associated criminal net- 
works""'''. This seemingly lack of effective strategy within law 
enforcement interventions was also recognized for the UK situ- 
ation^'. It was observed that law enforcement strategies focused on 
cannabis cultivation was largely reactive in nature, instead of proac- 
tively disrupting the responsible criminal networks. These studies all 
recognize the fact that law enforcement control strategies aimed at 
organized cannabis cultivation lack a focused direction and strategy. 

These criminal network problems do not exclusively relate to the 
control of criminal networks involving organized cannabis cultiva- 
tion, rather they are observed within the control of criminal networks 
at large*''''". Understanding how the observed cannabis cultivation 
network adapts to network disruption, might therefore contribute to 
a better understanding of the effectiveness of disruption strategies 
and network resilience. Before we discuss our research design in 
detail, we introduce the concepts of criminal network disruption 
and criminal network resilience. 

The concept of criminal network disruption. According to pre- 
vious studies, three indicators of network destabilization can be 
distinguished: a reduction in the rate of information flow in the 
network, a reduction in the ability to conduct its tasks or a failure 
or significant slowing down of the decision making process^^. 
Therefore network disruption can be defined in general as the state 
of a network that cannot efficiently diffuse information, goods and 
knowledge^*". Based on previous studies, strategies for criminal 
network disruption can be divided into two main approaches: The 
social capital approach and the human capital approach. 

The social capital approach. The social capital approach aims at 
strategic positions that individual actors occupy within criminal 
networks^'"*'*"'^^'^'. Like legal business, criminal networks depend to a 
large extent on social contacts and the ability to extract the necessary 
resources for their operations. The advantages that result from 
having social networks is called social capitaP"'^'^ . Research in this 
field is often based on social network analysis (SNA) to identify 
central actors in the network, that are associated with influential or 
powerful positions of social capital'". There are many ways within 
SNA to measure network centrality, but the two most common 
centrality measures that relate to strategic positions are degree 
centrality and betweenness centrality^'"'. 

Degree centrality measures the number of direct contacts sur- 
rounding an actor". Because high scores on degree centrality as 
associated with better access to resources, these actors are associated 
with influential and powerful positions within social networks. Since 
they are important for the flow of information and resources 
throughout the network, these actors are called hubs. Hubs have 
major influence on overall network structure, networks that gravitate 
around a few hubs, for instance, are defined as 'scale-free' (centra- 
lized) networks. In social network terms these networks are charac- 
terized by a power-law degree distribution, which means that a small 
percentage of actors have a large number of links'"^. In addition it was 
found that scale-free networks are resistant against random attacks. 
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because the majority of less connected nodes will more likely be 
targeted''^'. Moreover the loss of peripheral nodes for networks with 
central hubs is less significant for its network survival. On the con- 
trary, decentralized networks are mostly affected by random attacks 
because the loss of any single actor will be more important for the 
remainder of the network. Ironically, in the context of targeted 
attacks, network vulnerability inverses: central actors are more likely 
targeted, making centralized networks more vulnerable than decen- 
tralized networks. Knowledge of a network's structural features is 
therefore essential before the effects of any network intervention 
can be understood. 

As opposed to degree centrality, betweenness-centrality incorpo- 
rates the indirect contacts that surround an actor and is calculated by 
the number of times that an actor serves as a bridge (shortest paths) 
between other pairs of actors"'^*-'"'. Therefore betweenness centrality 
represents the ability of some actors to control the flow of connec- 
tivity (information, resources etc.) within the network^'''^^. Because 
these actors often bridge the 'structural holes' between disconnected 
(sub)groups, these actors are called 'brokers'. Burt explained the 
importance of brokers for an increase of social capital within entre- 
preneurial networks. Entrepreneurs on either side of the brokerage 
position rely on the broker for indirect access to resources and 
information beyond their reach""" '''. There is empirical evidence that 
brokers play important roles in connecting criminal networks con- 
necting separate criminal collectives within illegal markets'"''"* By 
attacking these brokers, important non-redundant opportunities to 
expand an illegal business might decrease. This is especially relevant 
for decentralized networks, such as terrorist networks'*'. Based on 
these studies betweenness centrality attack is recognized as another 
important strategy for criminal network disruption. In line with 
these studies, both centrality strategies will be applied to the orga- 
nized cannabis cultivation network within our models for network 
disruption (section 6.3). 

Although centrality strategies can be a very effective approach for 
disrupting centralized or decentralized networks in general, the 
application of this approach within criminal networks is not without 
discussion'. Peterson argues that the most central actors in covert 
networks might also be the most visible. Therefore they might be the 
most likely to be detected. According to Peterson high degree cent- 
rality can therefore also be associated with vulnerability instead of 
strength". In addition, Carley, Lee and Krackhardt also demonstrate 
that the most central actor isn't necessarily the network member with 
the most leadership potential. For instance, they found that in net- 
works were leadership and centrality are fulfilled by different actors, 
targeting the central node would not necessarily lead to a downfall of 
the network and that a targeted leader is not necessarily replaced by 
the most central actor^'. Robins emphasizes that features of network 
topology also interact with individual-level factors. Therefore qual- 
ities of individual actors (e.g. skills, expertise, information and know- 
ledge) cannot be ignored in understanding the complex dynamics 
within criminal networks^"*. In addition, a recent finding by Quax, 
Appoloni and Sloot show the diminishing role of hubs in dynamical 
processes on complex networks, indicating the need for alternative 
intervention strategies". These studies illustrate that although the 
centrality approach is a useful approach to identify potentially 'crit- 
ical' actors for criminal network disruption, an additional qualitative 
assessment on the individual level is essential for understanding the 
effects of network disruption. Moreover, besides centrality proposi- 
tions, individual qualities (human capital) might be a vital criterion 
for selecting critical actors for network disruption by itself This is 
called the 'human capital' approach. 

The human capital approach. The importance of the human capital 
approach to criminal network disruption has been addressed by 
several authors e.g."'*'^''''. Human capital is a term originated from 
economics that is defined as the stock of competencies, knowledge. 



social and personality attributes, including creativity, embodied in 
the ability to perform labor so as to produce economic value. Equal to 
legal business, every criminal market consists of a business process 
involving different steps of production or activity'*''"'. In each 
sequent step of the process different information, goods and 
human capital is exchanged and added to the next, following a 
chainlike structure. This process can therefore be defined as a 
value chain''". Every step of the value chain requires a different 
range of skills and knowledge human capital, depending on the 
specific characteristics of the illegal activity''"''''''''^. Illegal 
entrepreneurs involved in different criminal markets find these 
'human resources' in embedding trusted social networks. In this 
way human capital is assembled and integrated into tight goal- 
oriented criminal collectives. 

Sparrow suggested that identifying the actors fulfilling the most 
specialized tasks offers great opportunities for destabilizing the crim- 
inal network. Hence, as these are often thinly populated within the 
embedding social networks, they are the most difficult to replace if 
extracted from the network. Sparrow argues that 'substitutabUity' 
might therefore be an important criterion for network disruption'. 
To understand the structure of a criminal value chain Cornish intro- 
duced the crime scripting method**. This method helps systematize 
knowledge about the procedural aspects and procedural require- 
ments of crime commission, by generating a blueprint of all sequen- 
tial phases within the value chain. In addition, Bruinsma and 
Bernasco combined this crime scripting method with social network 
analysis, to identify 'human capital' and 'substitutabUity' within 
criminal networks*^. They found that specific specialized roles could 
be identified in different criminal markets by analyzing crime scripts 
within the context of the criminal network. Morselli and Roy applied 
this method to study 'brokerage roles' within criminal value chains*". 
Their observations reveal that 'value chain brokers' were essential for 
integrating 'human capital' from the criminal network, within the 
different phases of the value chain. In addition, Spapens identified 
this brokerage role within Dutch ecstasy production value chains and 
observed that these brokers not only increased 'social capital' within 
these criminal collectives, but added 'human capital' as well". Hence, 
these brokers possessed sufficient resources and reputation that is 
essential to initiate and coordinate a ecstasy production value chain. 
In fact, these findings emphasize that combining social capital 
approach and the human capital approach the effects of network 
disruption might be amplified. It can be concluded therefore that 
crime script analysis is an important method for identifying 'human 
capital' within criminal value chains. 

The concept of criminal network resilience. As a consequence of 
being disrupted, criminal networks develop the capacity to absorb 
and withstand disruption and to adapt to change when necessary, 
that is called network resilience. According to several authors the 
concept of resilience consists of two aspects: first, the capacity to 
absorb and thus withstand disruption and secondly the capacity to 
adapt, when necessary, to changes arising from that disruption*'" *'. 

The first aspect of the resilience concept depends on the level of 
redundancy that is inhabited in its criminal network structure. The 
more its network structure is characterized by high levels of redund- 
ancy in sense of diversity of relationships between actors, the more 
options there are to compensate for loses in 'human capital' or find- 
ing new methods to continue the value chain*". Redundancy enables 
members of the network to take over tasks of actors that are targeted 
by successful law enforcement operations. Even if some connections 
are broken, the diversity of different ties between actors allows the 
network to function. Redundancy in the network is associated with 
strong ties between network members. Strong criminal ties offer 
reciprocated trust, which is essential within the uncertain en hostile 
criminal environment'. Replacements with a reliable reputation are 
therefore often found within the social connections directly embed- 
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ding the actors involved within the criminal business process. These 
cohesive criminal collectives often initiate from already established 
social networks of for instance kinship, friendship or affective ties"*^'^". 
This means that replacements are often found in short social dis- 
tances, from this cohesive core. 

However, actors with essential skills or knowledge might have to 
be replaced. If these specialists are thinly populated within these 
redundant collectives, replacements have to come from the 'external' 
criminal environment. In these settings non-redundant social con- 
nections within the embedding network become important for find- 
ing 'human capital' at a greater social distance from the trusted 
criminal core. As described above 'criminal brokers' are essential 
catalysts for finding these replacements within the embedding net- 
work". This principle is called the 'strength of weak ties', were non- 
redundant ties within the embedding network offer access to new 
opportunities, resources and information, that are not available 
within redundant networks^^'^^ work offers a framework for under- 
standing criminal network phenomena, such as criminal careers in 
organized crime. For instance is was found that the social opportun- 
ity structure of social ties offers an explanation for late-onset offend- 
ing and people switching from conventional jobs to organized crime, 
also later in life^°. 

Although weak ties might reveal new business opportunities, find- 
ing replacements across these connections inhabits great risks to 
network security for two reasons. First, trust is more easily built 
between like-minded individuals, as compared to outsiders from 
different social and ethnic backgrounds'*"". This means that criminal 
networks in search for capable and trustworthy replacements might 
need to cooperate with criminal actors for who reliability is difficult 
to assess. Secondly, coordinating the search for replacements from 
the embedding network demands more efficient ways of internal and 
external communication. This increased transfer of information as a 
result of disruption or internal 'noise' within social networks in gen- 
eral, was also observed in a study of artificial complex networks"'''. 
This study shows that stochastic resonance in the presence of noise 
can actually enhance information transfer in hierarchical complex 
social networks, such as illegal networks^*. However, this increased 
transfer of information containing potential incriminating evidence 
throughout the network, also increases the risk of exposing the whole 
network by a single arrest^^'^"". The capacity to adapt to these changed 
circumstances of increased risk refers to the second aspect of the 
resilience concept. 

In adapting to these changed security settings, controlling the flow 
of information becomes the number one priority within illegal net- 
works'*^. Based on previous studies, this is often achieved through 
'compartmentalization, meaning that important information is iso- 
lated within different compartments or 'organizational cells'. This 
strategy prevents that the whole network becomes exposed, if one 
compartment becomes detected and disrupted'"'. As described above, 
this compartmentalization is often found in terrorist networks with 
longer times to task'*''. In addition. Baker and Faulkner also found a 
level of compartmentalization between the core and periphery within 
illegal price-fixing networks as a result of disruption'\ By deliber- 
ately separating the flow of information between members within the 
periphery and the 'visible' core, the price-fixing network decreased 
the chance of the 'leaders' becoming exposed after a single arrest. 
These studies show that in order to adapt to the changes circum- 
stances after disruption, criminal networks tend to organize a form of 
non-redundancy within its internal flow of information in order to 
protect its important members from becoming discovered. 

In fact, these features make criminal network resilience a paradox- 
ical concept. On the one hand it depends on redundancy, that's 
essential for finding trustworthy replacements after losses due to 
disruption. On the other hand it depends on non-redundancy, as 
the increased risks associated with the search replacement, demand 
compartmentalization of the flow of information to prevent further 



detection. The importance of either aspect depends on the given 
network objectives of recovery or security at a certain moment. 
This demonstrates again that criminal network resilience is a dynam- 
ical process that evolves along the tradeoff between efficiency and 
security which shapes its network structure accordingly. 

Research Design and Datasets 

As described above, the aim of this study is to unravel the dynamics 
of resilience within criminal networks, as a consequence of network 
disruption. This is done by simulating and observing the mechan- 
isms of disruption and -resilience in a criminal network involved in 
cannabis cultivation. First, we introduce five different approaches for 
network disruption, according to strategies based on the 'social cap- 
ital'- and 'human capital' approach previously described. Secondly, 
we introduce three models for network recovery, according to the 
principles associated with the resilience concept described above. 
These include redundancy and non-redundancy in relation to the 
social structure embedded in the disrupted criminal network. By 
simulating these disruption strategies and resilience mechanisms at 
the same time, we observe the way this affects its network structure in 
terms of efficiency and security. Our simulations are aimed at a real 
life criminal cannabis cultivation network that we analyzed from a 
large unique dataset obtained by a regional criminal intelligence unit 
resorting under the Dutch Police. This dataset contains information 
on criminals, criminal relationships and criminal activities collected 
over the period January 2008-December 2011. The details of the 
datasets are described in the next section, followed by a description 
of the final network representation and its properties in terms of 
degree distribution. 

Datasets. The dataset utilized in this research is built by the 
aggregation of two distinct datasets: Dataset Soft and Dataset 
Hard, details of these datasets are provided in Appendix A. 

Dataset soft (Djo/t)- The data for this dataset was collected by a 
regional criminal intelligence unit resorting under the Dutch police 
over the period January 2008-January 2012. The data is primarily 
retrieved from criminal informants and consists of anonymous 
intelligence reports on criminals and their criminal relationships 
involved in serious- and organized crime (N = 6020). Secondly, it 
contains information and reports from closed criminal cases aimed 
at organized crime. Both data sources contain specific variables on 
the individual roles that network actors occupy within different 
illegal markets in relation to the specific crime scripts (e.g. 
cannabis cultivation and trade, cocaine trade, heroin trade, ecstasy 
production and trade, trafficking of human beings etc.). These role 
variables are scored by intelligence analysts through structural 
analysis of intelligence reports on role specific information. 

Criminal informants have different motives to talk to the police 
and their identities stay covered for security reasons. In some cases, 
this makes it difficult to check the facts. For this reason this data is 
called soft data. Therefore we call this dataset soft (Djo^). However, 
based on detailed intelligence reports written after every conver- 
sation, the reliability of facts were checked by intelligence analysts 
by comparing this soft information with facts covered in other police 
data sources, such as criminal investigations data or street police 
reports. In addition to intelligence retrieved from criminal infor- 
mants the dataset therefore also contains observations from street 
police officers during their duty and information from (closed) crim- 
inal investigations. This includes detailed data from wiretaps and 
surveillance reports, as well as eyewitness and suspect statements 
containing additional information about criminal relationships. 
Incidentally information retrieved from online communities (e.g. 
Facebook) was also used in addition to construct relations between 
all known actors in the criminal network. 
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The main strength of this dataset is therefore that it contains 
detailed narrative information on criminal cooperation, individual 
roles and involvement within illegal markets from multiple data 
sources, including informants that are sometimes part of the criminal 
network themselves. This offers the opportunity to combine methods 
of crime scripting with social network analysis. Moreover it involves 
information about important criminal individuals that were never 
arrested nor detected within criminal investigations. In addition to 
previous studies on criminal networks that are based on closed crim- 
inal investigations, this dataset might give a unique perspective on 
criminal network structure, including the role of actors that are never 
observed before. 

A weakness of this dataset is that it is in part biased; there is a 
reasonable possibility that there are some blind spots within the 
criminal network we do not know about, because there aren't infor- 
mants within these networks. Another point of concern is that data 
collection is affected by police priorities. Secondly, not all facts that 
are written within the intelligence reports can be checked. This might 
be a risk to reliability of the data, if we want to look at a single criminal 
relationship in detail. However, for this study we are only interested 
in features of the overall network structure, therefore our results will 
not be affected by one or two false reports. Moreover, informants that 
turn out to be unreliable are fired directly; this results in a kind of 
natural selection of the most reliable informants. In order to alleviate 
some of these weak aspects we introduce a second dataset: Dataset 
Hard. 

Dataset hard (Duard)- This dataset consists of arrest records over the 
period 2008-2011. The dataset on arrest information consists of 
persons with a police arrest registration dating from the period 
2008 until 2011 (N = 24.284) within the same police region from 
which the soft data was collected. Every police suspect is registered 
into a police database with a connection to her or his arrest 
registrations. This arrest record contains variables of the date, 
time, place and law article for which they were arrested. This 
means that in case more actors are arrested for the same felony, 
they are connected to the same arrest record. Therefore it can be 
assumed with a reasonable level of certainty, that these actors have a 
criminal relationship at the time of the arrest registration. 

The strength of this dataset is that it was retrieved from police 
officers themselves, which makes it reliable. For instance, every per- 
sonal identity is being checked on the bases of identification. In 
practice police officers need more hard evidence than solely a crim- 
inal intelligence report to arrest a potential suspect. Therefore all 
potential criminal relationships following this dataset are based on 
more concrete evidence as opposed to dataset soft. Therefore we'll 
call this dataset hard {Di,ard)- Secondly it is bulk data over a relatively 
long period of time containing many criminal relationships. This 
offers the opportunity two recover a network structure based on 
arrests. Unfortunately arrest registrations do not contain much nar- 
rative information. Another weakness of this dataset is that import- 
ant network actors might be under represented in this dataset. 



because they don't get arrested easily as opposed to the more visible 
working roles in these networks. In addition, these arrest records are 
also to a certain extend biased towards police priorities. 

The description of both datasets reveals that this study isn't 
immune to the same dark figure problem that influenced previous 
criminal network research (e.g.'). However, every source of data 
offers another perspective on the criminal network that is the focus 
of this study. By combining intelligence reports (soft) with criminal 
investigations data, surveillance data and arrest data (hard), different 
perspectives of the same criminal network complement each other in 
offering us the most optimal observation of the criminal network 
possible. 

The criminal network structure. As described above, the key 
property of the current dataset is the presence of information 
about criminal activities of actors, their individual roles and 
connections to other actors. By combining the two datasets we 
have recovered the structure of a criminal network involved in 
multiple criminal markets operating within the Netherlands. In 
accordance criminal network theory described above, we can 
distinguish between two network levels: the criminal network 
involved in a specific illegal market and the (social) embedding 
macro- network from which criminal cooperation originates"'""'*'. 
The embedding macro network contains all actors and criminal 
relationships between all actors disregarding their illegal activities. 
A criminal relationship is defined as the social links that enable 
individual members of the network to freely exchange information 
about potential illegal activities. Therefore this embedding network is 
called the 'macro network', and we will denote it by (jMacro- 

By itself, 

Guacro is buUt Up from the dataset D^^p which is collected by criminal 
intelligence operations as well as the dataset DharS which is gathered 
from arrest registrations. In constructing GMacm the two datasets 
show little overlap (see Table 1). This can be explained by the fact 
that central key players are often protected by the network structure, 
and therefore have a lower chance of becoming arrested, as compared 
to actors directly involved in the value chain. As a consequence these 
actors are generally underrepresented within investigative or arrest 
data, which also characterizes dataset D^j^rd- In contrast dataset Djo^, 
is buUt from criminal intelligence gathering and is collected with the 
specific aim of identifying the invisible actors, who stay largely 
unknown within criminal investigations. Both datasets therefore 
offer a different observation of the same criminal network. The 
combination of these two observations provides us with a unique 
empirical perspective of a criminal network structure. 

The second level of network structure consists of all actors 
involved in the specific value chain of organized cannabis cultivation. 
This second level micro-network is obtained by removals of all actors 
and connections from GMacro> which are not involved in the value 
chain of cannabis cultivation as qualitatively scored within Dsoft- This 
sub-network wiU be denoted by Gyc- Within Gyc there is data on the 
specific roles of individual actors within the value chain of organized 



Table 1 | This table shows the properties of the Soft (criminal intelligence data) and Hard (arrest registration data) datasets. In the third 
column the overlap between the two datasets is depicted. The fourth column shows the macro network structure. The fifth column shows the 
properties of the subnetwork of actors involved in cannabis cultivation. This subnetwork is constructed by removing all actors and links not 
involved in the cannabis production network 



Network/Stats D,ah Dhard D^^ft Pi D/,ord G^acro = Dsofr + Dhard Gyc 



Number of Actors 6020 24284 958 29346 793 

Number of Links 12073 35359 1438 47127 1388 

Avg. degree 4.01 2.91 3.6 3.21 3.92 

Avg. shortest path 5.48 9.81 5.75 8.62 4.35 

Diameter 20 26 14 25 11 

Largest component 3998 9413 535 13964 459 
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cannabis cultivation. Properties of both networks are described in 
Table 1 and depicted in figure 1. 

In order to test the effectiveness of the three network disruption 
strategies described above, we need specific data on the value-chain 
activity of the individual actors within the network. Because data on 
value chain roles is qualitatively scored for all individual actors 
involved in cannabis cultivation, we focus mainly on the effectiveness 
of disrupting the cannabis cultivation network Gyc part of the 
criminal macro network G Macro- 

Identical to any social network, criminal networks have no strict 
boundaries'"'. Therefore we emphasize that the embedding macro 
network is in theory a worldwide network'". However, our observa- 
tions of the embedding criminal network are limited to where the 
data collection process within the police region ends. Within social 
network analysis methodology this is called the 'boundary specifica- 
tion problem' (e.g.'*''), meaning that setting a boundary of the net- 
work as a result of the available data, might affect the results of the 
applied SNA methodology. But, as described above, replacements are 
preferably found in the 'trusted' and 'like-minded' network directly 
embedding the disrupted criminal network, instead of replacements 
from outside through other backgrounds. Moreover, from a practical 
point of view, finding replacements within substantial physical dis- 
tances would be counterproductive* ". 

Degree Distribution 

For one part the effect of different disruption strategies depends on 
network topology. As described above, one important measure for 
network topology is the network degree distribution. If the network 
degree distribution follows a power law, then the network is scale- 
free. This means, besides other implications, that network robustness 
depends on actors with a relatively high degree, so-called hubs. If 
these hubs are attacked the network will fall apart into subnetworks''"'. 



We estimate the power-law distribution P(x) = Cx~'' to fit the degree 
distributions in the GMacm ^nd Gyc networks using maximum like- 
lihood estimators as well as a goodness-of-fit based approach to 
estimate the lower cutoff for the scaling region*', the results of which 
are shown in Figure 2. 

Analysis of the graphs show that for GMacm the degree distribution 
fits a power-law with a lower cutoff of Xnji,, = 34 and ). = 1.5. For Gyc 
the lower cutoff equals 1 and 1 = 1.5. In both cases the p value is 
relatively high, indicating that with high likelihood these distribu- 
tions follow a power law distribution. This means that both networks 
probably are scale-free and might therefore be vulnerable to delib- 
erate attacks, targeting actors with high degree centrality (hubs). 

In the next paragraph describe in more detail how it the networks 
are structured with respect to the value chain structure of the can- 
nabis cultivation. 

Value chain configuration of organized cannabis cultivation. As 

described above, organized cannabis production is a delicate business 
process, involving many tasks and roles and flow of human capital, 
information and resources, which can be described in a value chain 
by using crime script analysis. Fig. 3 shows the result of crime script 
analysis of an illegal market of cannabis cultivation, containing all 
phases and corresponding tasks/roles in sequential order"'^^ '"'". 

Understanding the value chain of a specific criminal activity is 
important for developing network disruption strategies from the 
'human capital' approach. Specific roles can be identified, that are 
critical for value chain continuation. Within the technical system of 
cannabis cultivation the roles of 'coordinator and 'growshop owner 
are essential for initiating a criminal collective (Fig. 3). They control 
almost every stage of the value chain and operate as criminal brokers 
in bringing essential roles together at the right place and time. 
Coordinators and Growshop owners are important for the flow of 
information and keeping the value chain participants together. 




Figure 1 | Socio-graph of the criminal network under study: Gvc (light-colored actors) represent network members that are involved in cannabis 
cultivation. Gyc is part of GMacro which includes the actors from the criminal macro network that are connected through other criminal activities (dark- 
colored) actors. 
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Therefore these roles can be marked as vulnerable for network dis- 
ruption from both a 'human capital'- and 'social capital' approach, as 
they might also score high on degree and betweenness centrality 
within the value chain network. 

Secondly specialists can be identified within the criminal collective, 
that bring specific knowledge or skills needed to complete the value 
chain' "'"'^. These specialists are often sparsely populated within the 
embedding macro-network and are therefore often part of more than 
one value chain at a certain point in time. Within the value chain of 
cannabis cultivation the network members that fulfill the role of 
diverting electricity can be identified as specialists for two reasons: 
First this role requires specific knowledge and technical skills needed 
for illegally diverting electricity that fits the needs within cannabis 
cultivation. Secondly these roles demand high levels of trust and 
reputation. Hence, these ^electricians might retrieve sensitive 
information about critical locations and participants that is related 
to their flexible role of specialist^^ *"^. Therefore involvement of these 
actors increases the risk of information being leaked to competitors 
or the government'"''. A trustworthy reputation is therefore essential 
for these specialists to operate freely. For cannabis networks, finding 
or replacing these 'specialists' is not an easy task because reliability 
and integrity is not particularly part of the ethics within criminal 
networks. Therefore network members involved within ^diverting 
electricity can also be identified as vulnerable targets for network 
disruption from a 'human capital' approach. This will be included as 
a specific strategy within the disruption model discussed in section 
6.1. 

As was previously described criminal network resilience against 
disruption depends on network redundancy. Redundant criminal 
networks offer many alternatives to replace targeted actors within 



the network. Figure 4 shows the direct relationships between value 
chain roles that are derived from the value chain network of cannabis 
cultivation (Gvc). In this figure the VC roles are also connected if one 
actor in the social system fulfills more than one role within the value 
chain (Fig. 3). The size of the actors in Fig. 4 is proportional to the 
amoimt of actors having this role within the data. The thickness of 
the links corresponds to the number of direct connections between 
actors with these roles within the Gvc network. 

The infographic shows that some roles within the value chain are 
highly connected and some roles are not. This indicates that some 
actors involved in common roles within Gyc might easily be replaced 
by directly reconnecting the 'orphaned actors' with actors with that 
same role in Gvc (e.g. network members that are involved in 'coor- 
dination' and 'taking care of plants' in fig. 4). For roles that aren't that 
well connected within Gvc (such as manipulating electricity and 
building a plantation in fig. 4) replacement isn't that easy, for reach- 
ing the possible replacements might take several indirect connec- 
tions. As described above trust and reputation are the basis for 
criminal cooperation^""*^. Therefore actors connected within a spe- 
cific value chain network are often surrounded by a social structure of 
social ties (e.g. kinship or friendship) or previous criminal coopera- 
tion concerning other criminal activities. As descibed in 5.2 this 
surrounding social structure is called the 'embedded macro network' 
Guacro- Trustworthy replacements within criminal network are gen- 
erally found at the shortest paths from the targeted actor towards the 
nearest potential replacement. This means its also possible that repla- 
cements are found trough actors that are part of the embedding 
macro network but have no involvement in the value chain network 
of cannabis cultivation at all. These actors from the embedding 
macro network form a 'bridge' between the 'orphaned actors' and 
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Figure 3 | Value chain components of organized cannabis cultivation (after: Emmet and Broers, 2009; Morselli, 2001; Spapens et al., 2007). 
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replacements with the same role in Gvc. Therefore replacement fol- 
lows the shortest paths through actors from the embedding macro 
network, instead of solely the value chain network. This interaction 
between the embedding macro network {GMacm) and the value chain 
network is therefore important for understanding criminal network 
recovery after intervention and will be explained further in para- 
graph 6.3. 

Methodology 

The second aim of our research is to test the effectiveness of different 
strategies to disrupt an illegal cannabis cultivation network Gyc 
taking into account that the network will try to recover itself by 
replacing targeted actors and relations using ties and connections 
of the embedding criminal network GMacm- Therefore a modeling 
framework for both network disruption and network resilience is 
needed. 

Modeling network disraption. From a law enforcement perspective 
criminal network disruption aims at stopping or frustrating the value 
chain of a criminal activity by removing active actors from the 
criminal network. In practice this can be obtained by strategically 
targeting and arresting individual actors involved in the value chain. 
The sequential order in which actors are targeted depends on the 
disruption strategy applied. For this study five different disruption 
strategies are selected according to the general disruption approaches 
described above: 



Random disruption 

1. The Random strategy follows no preference or ranking during 
selection of candidates for removal. This strategy can be assoc- 
iated with opportunistic law enforcement control lacking any 
form of strategy. As describes in section 2, this is sometimes 
the case within the control of organized cannabis cultivation, 
for instance randomly busting cannabis cultivation sites and 
making arrests on the spot. 

Two types of social capital disruption. The social capital approach 
aims at strategic positions within criminal networks. As described in 
section 3, this can be divided in two main strategies: degree centrality 
attack (hubs) and betweenness centrality attack (brokers). 

2. The Total degree strategy aims at the actors with highest degree 
centrality (hubs) within the Gyc network. From this approach 
the order of actors being targeted follows individual degree cent- 
rality scores from high to low. Both Guacro and Gyc networks 
have heavy-tailed degree distributions, which might make them 
vulnerable to these hub attacks (Fig. 2). This strategy is assoc- 
iated with control strategies that focus on 'the kingpin'. 
However, as described above the most central actor does not 
necessarily have to be the most powerful. Leaders might be hid- 
den in anonymous periphery, but because we use intelligence 
data in addition to investigative data, degree centrality might 
correlate with powerful positioning (e.g.*'*). 



[Coordinator ) 




Figure 4 | Observed configuration of tlie social system of tlie cannabis cultivation value chain using soft and hard datasets, see also appendix A. 
Within this system roles are connected if there is at least one link in the value chain network (Gvc) between actors of these roles. The sizes of the 
actors correspond with the number of actors fulfilling this role, and link thickness corresponds with the total number of links between roles within the 
data. 
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Figure 5 | Dismantling and recovery of a network: (a) Actor A is selected as a target actor by a chosen strategy, (b) Actor A is detached from actors B, C, D 
and removed from the network, (c) Orphaned actors B and C recover their connections by linking to actor E of the same role as actor A (here: 
coordinator). 



3. The Betweenness strategy aims at actors with the highest 
betweenness centrality (bridges) within the Gvc network. 
From this approach the order of actors being targeted follows 
individual betweenness centrality scores from high to low. This 
strategy is associated with the 'key player' control strategy in law 
enforcement. This strategy might be highly correlated with coor- 
dinators of growshop owners, but could also involve actors in 
other roles that might be or importance because of their informal 
social capital within the value chain. It aims at strategically posi- 
tioned brokers, connecting several criminal groups as described 
in section 3.1. 

Two types of human capital disruption. Besides targeting actors 
based on their general positioning within the criminal network, this 
approach aims at targeting actors by their individual specific 
characteristics (Human Capital). 

4. The Value chain degree strategy aims at individuals with the 
highest Value Chain (VC) degree within the Gyc network. The 
VC degree of a particular actor is measured by the amount of 
links defined within the social system of the value chain config- 
uration (see Fig. 3). This strategy is associated law enforcement 
controls aimed at actors that inhabit a great reputation. It can be 
assumed that actors with a higher reputation wUl be involved 
within more and different value chains within the value chain 
network. From a network perspective this means that these 
actors wUl automatically have a higher degree centrality and will 
be more visible within the network. 

5. The Specific Value Chain Role strategy aims at specific 'human 
capital' within a specific criminal value chain. As compared to 
other strategies, actors are targeted qualitatively based special 
skills or knowledge and the presumed 'substitutabUity' within 
the value chain. Based on observations within the data under 
study and the literature on the cannabis cultivation value 
chain^^*^ the role of 'diverting electricity was selected to analyze 
this strategy. From this approach the sequence of actors being 
targeted follows all actors that are labeled for the 'diverting elec- 
tricity role within the value chain of cannabis cultivation. This 
strategy is associated with the 'facilitator' strategy within law 
enforcement control, for targeting thinly populated specialists 
in order to frustrate the operational criminal process. 

By simulating these strategies we can measure the effect they will 
have on the network and cannabis production. For each strategy, 
different runs are being performed and for each run thirty actors 
are being removed. 

Modeling network resUience. The effect of network disruption 
cannot be measured without understanding network resilience. 



Therefore the ability of a criminal network to recover its value 
chain structure after applying a network disruption strategy has to 
be simulated. In order to recover the value chain, the actors that are 
not targeted (orphaned actors) will have to find a replacement that 
can fill the gap that a targeted value chain actor left behind. This 
replacement needs the same skills and knowledge (VCrole) as its 
ancestor. By replacing the actor by someone in the network with 
the same VCrole, the essential VC links are reestablished and the 
value chain can be operational again. As described in section 4, these 
replacements are often found through redundant or non-redundant 
contacts from the embedding network GMacro- By modeling 
resilience, we therefore simulate the dynamic interaction between 
the value chain network Gyc and the embedding criminal network 
GMacro in the search for suitable replacements for network recovery. 

At each step of the simulation an actor is targeted by applying one 
of the disruption strategies. This targeted actor is indicated by n„m. 
All «rem actors will be accounted for in a set 0(nrem) of 'orphaned' 
actors, which were connected to n^^^ by a value chain connection 
(VC link). For each broken VC link, it is assumed that recovery wiU 
start from these orphaned actors. These actors will be the first to find 
replacements within the embedding macro-network {Gvc) as 
depicted in Fig. 5. 

At first target actor (A) is selected by one of the preferred dismant- 
ling strategies (Fig. 5a). Actor A has two adjacent VC Links with 
actors B and C. In the next step (Fig. 5b) target actor A is removed 
from the network, leaving two dangling links. The orphaned actors B 
and C tend to recover the lost links by connecting to actor with the 
same VC role of coordinator as the A actor had by using one of 
recovering algorithms. In this way the broken VC links are recovered 
by connecting to actor E (Fig. 5c). In simulating network resilience 
three recovery mechanism algorithms are applied: random recovery, 
recovery preferred by distance and recovery preferred by degree. The 
general recovery algorithm is depicted below. 

General recovery algorithm. 

Gvc(N>£) — subnetwork with a set of actors N and set of edges E; 
nrem — actor which was removed from Gva 
0(«rem) — Set of Orphaned actors «o, which were adjacent to n„m; 
role{n) — VC role of actor n; 

RNinrem) = {« G N:role{n) = role(nrem)} — set of actors from Gyc 
which can replace value chain position of actor 
For each orphaned actor no from 0{nrem)'- 

1. With likelihood P rewire = 1 ~ 1 7 Ti evaluate whether or 

not the lost VC link wiU be recovered by no- 

2. If previous step gave positive answer, then select recovery can- 
didate from the RNinrem) following specific preference, which 
is chosen based on the recovery mechanism. 

3. Connect actors Hq and n^. 
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Figure 6 | Random and preferential recoveries of broken VC links are depicted, after strategically removing actor B: (a) Candidates for replacement are 
chosen randomly without preference, (b) An actor with a smaller distance to orphaned actor A is more likely to be chosen as replacement, 
(c) An actor with a higher degree is more likely to be chosen as replacement. 



Next, we introduce three algorithms, which are based on this 
general recovery algorithm but have a specific preference among 
candidates for recovery. See also figure 6. 

Random recovery algorithm. The random recovery algorithm sug- 
gests that no candidate from RNinrem) has preference over others, and 
all of them are treated equally. This algorithm implies that the macro 
network is heterogeneous and that replacements can be chosen from 
all parts of the network, hence, at step 2 of the general recovery 
algorithm candidate «^ from i^N("rem) is selected randomly. 

Preference by distance recovery algorithm. As described in section 4 
trust and skills are important criteria for selecting suitable replace- 
ments. Therefore it's more likely that preferred replacements are 
preferably found within the redundant network of the actors 
involved in the value chain. This means that candidates with the 
shortest path from orphaned actors within the macro network 
(G_Macro) will have more chance of becoming a replacement than 
actors further away. This can be translated into a preference by 
distance recovery algorithm, in which the selection of replacement 
of actors from -R_N(«rem) in step 2 depends on the distance between a 
possible candidate actor and an orphaned actor. Within this pref- 
erential recovery algorithm the likelihood of actor n^ to be selected is 
proportional to ^/^, where d is the distance between the orphaned 
actor and tt^. Within this recovery mechanism, the likelihood that a 
value chain link wUl be recovered depends on both the substitutabil- 
ity and the network distance between replacement candidates and 
orphaned actors. 

Preference by degree recovery algorithm. A second criterion for crim- 
inal cooperation is reputation. This means that actors with a good 
reputation have a higher chance of becoming a replacement than 
actors with a bad reputation. It can be assumed that actors with a 
higher reputation will be involved within more and different value 
chains throughout the overall network {(jMacro)- As identical to the 
VC degree disruption strategy, this will be associated with actors with 
high degree centralities. Therefore we introduce a third recovery 
algorithm with a preference for replacements by degree-centrality, 
in which the selection of replacement actors from -RAr(Mrem) in step 2 
of the general recovery algorithm depends on the degree centrality of 
the potential replacement. Within this preferential recovery algo- 
rithm the likelihood of actor n^ to be selected is proportional to 
where d is the degree of within Guacro- 

Within the general recovery algorithm, the likelihood of value 
chain link recovery Prewtre depends on the exchangeability of the 
targeted actor. If RNinrem) = 0 then the connection with an actor 
of a particular role could not be recovered. 

The difference between random recovery (a), distance recovery (b) 
and degree recovery (c) is depicted in Fig. 6. Here, actor B is targeted 
by one of the disruption strategies. As a result the orphaned actor A 
has lost its value chain connection 'international trade-transporting', 
and will therefore try to re-establish a link with a suitable candidate in 
order to restore the value chain. The list of candidates, who can fulfill 
the same role as A, is shown in the first column. In case (a) the 



candidates are chosen randomly and have no preference between 
each other to be chosen as a candidate for recovery. In case (b) the 
actors with the shortest distance to A, are more likely to be selected 
for replacement. In case (c) the actors with the highest degree are 
more likely to be selected for replacement. 

Measuring the effects on network structure. After the disruption 
strategies and the recovery strategies are applied at the same time, 
after a number of attacks following the same strategy, we want to 
measure the impact this has on its networks structure, in terms of 
efficiency and security. Therefore we introduce the measure of 
efficiency within the Value Chain network Gyc that is computed 
by the following metric: 



1 ^ 1 

Efficiency{Gyc)^^^^^J2- 



(1) 



In this metric djj corresponds to the distance between actors and j of 
Gvc and N equals the amount of actors in Gyc The denominator 
creates a measure that varies from 0 to 1, where 1 is complete 
connectivity and 0 indicates that the network is completely 
separated into isolated components. Note that in this metric the 
distance between actors is measured by the shortest paths within 
the embedding network (Gmacro)- This implies that some essential 
values can flow through criminal relationships that are not directly 
derived from the subnetwork of cannabis cultivation (Gyc)- The 
metric shows how efficiently actors within the network can 
communicate and exchange values (information, goods) between 
each other""''"'. 

In addition to the efficiency of the network we introduce a second 
metric that estimates the influence of network disruption on the 
secrecy within the value chain network. Criminal network structures 
arrange a level of secrecy by minimizing the direct transfer of 
information, thereby reducing the risk of exposing direct involve- 
ment in illegal activities of individual members to police surveillance- 
or intelligence services. Secrecy is strongly associated with the metric 
of 'network density'. This measurement is intended to give a sense of 
how well communication pathways in the network are capable of 
getting information out to the network's participants. Density (or the 
equivalent 'brightness') is calculated by dividing the number of direct 
connections by the maximum possible connections within the 
observed network. Therefore density decreases by a decreasing num- 
ber of direct connections. This slows down the direct transfer of 
information throughout network. A network with a high density is 
more effective thanks to the large number of direct connection 
between actors, but it has higher vulnerability as well, because if 
one actor is caught he can provide critical information about other 
participants of criminal business''^. This metric is based on the ana- 
lysis of network density after interference, in comparison to its initial 
state. The density, or brightness, of the network is calculated by the 
following metric: 

UensityiG.,)^^^ (2) 
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Figure 7 | Efficiency of the value chain within the network using 'random Figure 8 | Efficiency of the value chain within the network using 
recovery' during various law-enforcement strategies. 'preference by distance' recovery during law-enforcement strategy 

simulations. 



In this metric E{GyJ) corresponds with amount of hnks in Gyc Eind N 
equals to amount of actors in Gyc- The values of this metric are also 
bounded between 0 and 1, where 1 happens to be in complete net- 
work where aU actors are interconnected and, hence, exposed, and 0 
indicates that the network is completely dismantled, dark and secure. 

Results 

In order to test the network resilience of Gvo three sets of simulation 
experiments were conducted - with random recovery, with distance 
recovery and degree recovery algorithms. Each simulation was per- 
formed on GMacm and because the aim is to disrupt the value chain of 
organized cannabis cultivation, disruption strategies are targeted at 
the actors who are specifically part of Gyc- In each simulation thirty 
runs for every disruption strategy were conducted, resulting in an 
average score for each strategy (the numerical experiments showed 
that ten runs were enough to get stable results with standard devia- 
tions less than 5%). As described above, the role-specific strategy was 
targeted at all actors involved in the role of 'diverting electricity . 

Fig. 7 presents the efficiency of the value chain network Gyc with 
random recovery at each step of the law enforcement strategy. In 
contrast with the aim of the applied strategies, it shows that as the 
disruption strategies are being applied the efficiency of Gyc actually 
increases. This means that when more specific actors are being tar- 
geted from the value chain, the more efficient the network becomes 
after random recovery. Fig. 7 also indicates that Random and Role- 
specific disruption strategies slightly increase the network efficiency. 
From a topological perspective this implies the network is highly 
resilient and flexible in restoring these crucial value chain facets from 
its network structure. On the other hand, when the 'role specific' 
specialist strategy is taken into account the network might be much 
more vulnerable. Hence, the value chain simply ends when a single 
facet within the technical system of the value chain (as depicted in 
Figure 4) cannot be restored from its social structure. Therefore, this 
role specific disruption strategy is only effective in the long run (after 
removing 18 actors), when the VC network is not able to replace the 
specialists of 'diverting electricity' any more. Furthermore the VC 
degree attacks seem to have the most disrupting effect on the network 
efficiency during the initial steps of the simulation. In summary. 
Fig. 7 shows, counter intuitively, that when the criminal network 



recovers itself randomly from all five disruption strategies, the net- 
work becomes more efficient as compared to its previous state. 

In Fig. 8 the results for the simulation of 'preference by distance' 
recovery is depicted. For this recovery mechanism the network effi- 
ciency does increase with a slightly lower rate in comparison to the 
previous case with random recovery due to the fact that fewer short- 
cuts appear in the network during the recovery process. These results 
show that if the network restores itself by finding replacements that 
are close, the VC disruption strategy will have the biggest impact on 
the network efficiency. 

In Fig. 9 the results for simulation with 'preference by degree' 
recovery are depicted. This means that the VC network prefers to 
replace someone by actors that are most easy to find, because they are 
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Figure 9 | Efficiency of the value chain within the network employing 
'preference by degree' recovery during law-enforcement strategy 
simulations. 
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Figure 10 | Roles affected by disruption strategies applied to a network with preferential recovery. 



more visible within the network. This recovery mechanism shows 
ahnost the same pattern as the preference by 'distance recovery' 
mechanism. 

In addition to these simulations, Fig. 10 shows the roles that are 
removed from the network by applying three different disruption 
strategies ('Random' and 'Role-specific' strategies showed no rel- 
evant effects). This figure indicates the difference in impact that 
the three interventions have on specific roles wdthin the value chain. 
In accordance with criminal network theory, it shows that 'visible' 
roles like taking care of the plants and transporting the product are 
vulnerable to these network disruption strategies. In general these 
roles are directly involved in the value chain and as a result score high 
on degree centrality. But it is important to note that central key player 
roles, like Coordinator, International trade and Financing also seem 
to be highly affected. This implies that these central key players are 
not that much concealed in the criminal network, as was assumed in 
previous studies. Furthermore Fig. 10 shows that 'specialist' roles, 
like ^ diverting electricity and 'building plantation , are not affected by 
these strategies and are therefore the ones that might be protected 
within the network structure. 

Fig. 1 1 depicts what happens with the density (brightness) of value 
chain network Gva before and after applying the disruption strat- 
egies. It shows that the brightness of the value chain network actually 
increases as a consequence of intervention. This is a result of the fact 
that network members that try to continue criminal activities are 
forced to communicate efSciendy as a result of the applied network 
disruption strategy. Hence in order to recover the value chain, these 
members have to act as brokers to establish new value chain relation- 
ships. Consequentiy overall network density increases, and it becomes 
more redundant after each intervention, forcing the cannabis cultiva- 
tion value chain network to expose itself increasingly from the dark. 

Discussion 

In this paper we present the impact of dynamic network recovery on 
the effectiveness of four different criminal network disruption strat- 



egies. A unique dataset of a large complex criminal network involved 
in organized cannabis cultivation was the starting point for the simu- 
lation and analyses of these disruption strategies. In addition three 
different network recovery mechanisms were investigated, in order 
to assess the effects on network structure in terms of network effi- 
ciency and security (secrecy). 

Previous studies of criminal network resilience showed that coor- 
dinators try to keep a social distance from the actual flow of illicit 
goods within the value chain. These key players therefore limit their 
direct connections to actors involved in executive tasks, to minimize 
the risk of exposure'"''^-'*^ '"'''''. Based on these studies, high scores for 
degree and betweenness centrality were expected for executive actors 
directly involved within the technical value chain of cannabis cul- 
tivation. This hypothesis is partly consistent with our observations 
for the roles oi'transporf and 'taking care of plantation (see Fig. 10), 
which are vulnerable to degree- and betweenness attacks. However 
our results also show, that central key-player roles within the value 
chain of cannabis cultivation, such as 'coordinator, 'financing and 
'(inter)national trade', are highly visible and therefore vulnerable to 
degree centrality attacks as well (see Fig. 4 and Fig. 10). From an 
efficiency/security perspective, this implies that the structure of the 
observed cannabis cultivation network is very efficient and flexible, 
but rather insecure. Hence, if these key players become exposed, the 
whole value chain might become visible. How can this be explained? 
The answer to this question is concealed into two factors: a) specific 
features of the cannabis cultivation process b) the observed prop- 
erties of the dataset. 

Cannabis cultivation is a delicate process, involving many roles 
and functions. In order to bring these roles together at a certain time 
and place, the role of 'coordinator is essential for retaining the tech- 
nical system of the value chain (Fig. 2). To fulfill this role, informa- 
tion needs to be exchanged efficiently through the value chain 
network. Coordinators therefore need to occupy strategic hub or 
bridge positions within the network, naturally resulting in higher 
than average scores on degree and betweenness centrality observed 
within our data. 
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Figure 1 1 | Difference in density of the overall network Gvc after applying (a) strategies with random recovery, (b) preference by distance and (c) 
preference by degree recovery. Density is associated with brightness of the network, and is presented as a percentage relative to its initial value. 



However, in practice this doesn't necessary make these actors easy 
targets for network disruption strategies that focus on high degree- or 
betweenness positions, since these vulnerable positions are also 
recognized by criminal networks themselves. Non- redundant and 
compartmentalized ways of communication are applied, keeping 
these central key players highly concealed from direct involvement 
within the value chain'''"''^''"'''^ '". As a consequence, reliable incrim- 
inating evidence of involvement of the direct involvement of these 
'critical actors' within illegal markets and activities is harder to 
retrieve, as compared to actors directly involved within operational 
activities of the value chain. This explains why these actors can oper- 
ate from the core of the network but stay concealed in the dark at the 
same time. However, this is still in contrast with the high levels of 
'visibOity' these key players seem to have as we observed from the 
data (see also Appendix A). An explanation can be found within the 
detailed properties of our dataset: 

Empirical criminal network research is often based on a single 
source of data, such as closed criminal investigations e.g*-*'"'""". 
These datasets often contain detailed observations of the behaviors 
and roles of the suspects under investigation. However, due to lim- 
ited resources and time, criminal investigations generally start off 
with a specified and restricted objective. Depending on this objective, 
the scope of data collection within these investigations is naturally 
confined by the jurisdiction, money or law enforcement capacity^. 
Because of these investigative boundaries, chances that powerful or 
influential actors become exposed within criminal investigation data 
are relatively low. To overcome this potential bias in our study, 
multiple data sources were combined to retrieve the final network 
representation. Some of the data-sources were criminal informants, 
who sometimes are part of the criminal activities themselves and 
operate as direct eyewitnesses for 'unknown' criminal cooperation. 
One of the initial goals of this specific intelligence process is delib- 
erately discovering 'hidden' critical actors, who try to keep their 
identities concealed in the dark. These unique data properties offer 
us a different perspective on the criminal network structure, often 
hidden within data solely retrieved from criminal investigations. This 
offers another explanation for the visibility of the 'hubs' observed 
within our results. 

We recognize that our dataset is not immune to missing data and 
boundary specification problems and we understand the difficulty 
involved with retrieving reliable criminal network data. But, inter- 
estingly our results emphasize the importance of 'no boundary intel- 
ligence gathering focused on criminal networks at a 'macro' level, for 
retrieving a better strategic understanding of the way these networks 
operate and react. Combining multiple sources of data on criminal 
cooperation seems to be essential in confining these data validity 
problems. The importance of a 'no boundary' intelligence gathering 
strategy, was also one of the results of a recent study by Dijkstra 



et al.""" that show how a dark population of susceptible and infected 
drug users in Russia can be identified on the basis of social media 
information. This strategy opens the door for actually seeking rather 
than assuming criminal network structure'. In addition, our study 
shows the importance of applying combinations of methods to 
unravel the complex dynamic network structures. The knowledge 
generated by combining social network analysis with computational 
simulation in this paper, might be of direct relevance for thinking 
about the effectiveness of control strategies of organized crime on an 
operational level. 

Conclusion 

The aim of this study is to unravel the dynamics of resilience within 
criminal networks, as a consequence of network disruption. Based on 
the numerical studies of four different disruption strategies and three 
different recovery mechanisms presented here, it can be concluded 
that disruption of the criminal cannabis network is relatively inef- 
fective. After applying multiple removals of actors the network effi- 
ciency is hardly affected. On the contrary, efficiency actually 
increases over time for the value chain degree disruption strategy, 
as a direct result of efficient network recovery. It was shown that the 
integration of a replacement within the network leads to new short- 
cuts, which in turn reduces overall dimensionality. Our results point 
out that a delicate criminal process, such as cannabis cultivation, is 
organized in a flexible and adaptive network structure, which is 
highly resilient against network disruption. 

In part these results can be explained by the natural evolution of 
these criminal networks over time. As reciprocal connections within 
the embedding macro-network expand over time, existing connec- 
tions between value chain members might have become sub-optimal. 
However, if the value chain itself is still functional, these 'inefficient' 
connections within the value chain configuration might not cause 
any problems for a criminal value chain to evolve. In fact, they might 
even increase security within the value chain, by naturally shaping 
the network in non-redundant way. Within these settings, chances 
are that in search for a replacement non-redundant value chain 
connections become optimized (redundant), leaving the network 
more efficient then in its previous state. 

Previous criminal network studies attribute this phenomenon to a 
'snowball effect', by which 'structural holes' between different crim- 
inal sub-networks dry out by increasing reciprocal social relation- 
ships over time (e.g. friendship, kinship, affective)^^. As new illegal 
opportunities for criminal network expansion emerges, this process 
starts all over again leading to further network expansion"". 
According to this interpretation, our results emphasize that interfer- 
ence in an established 'old' value chain network will be less effective 
than intervening in a recently established criminal network or value 
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chain. In fact, the best way to disrupt a criminal network might be not 
to apply any disruption strategy at all. 

These conclusions might sound disturbing for government- and 
law enforcement that fight to control criminal networks on a daily 
basis. However, we need to realize that network effectiveness 
depends on both efficiency as well as secrecy''"''^'^^. The capability 
of criminal networks to organize secrecy after an attack depends on 
the flexibility of the network to benefit both from the redundancy as 
well as the non-redundancy that's inhabited within its network struc- 
ture, according to the circumstances. Redundancy is needed when 
looking for trustworthy replacements within the embedding net- 
work. In addition, non-redundancy is essential for finding replace- 
ments that are difficult to find at a greater social distance and for 
keeping critical roles and information differentiated and secret, in 
order to prevent revealing the whole network by one arrest. From this 
perspective. Fig. 11 shows that the number of actors close to the 
average degree centrality increases, meaning that also 'not so well- 
connected' actors will become more visible than before disruption 
strategies were applied. This means that after every attack the crim- 
inal network becomes more and more redundant. Forcing the net- 
work to become efficient, but at the price of a higher visibility 
(brightness), the network becomes less 'dark'. The criminal network 
might even become imbalanced, leading to progressively more expo- 
sure after replacements are integrated within its structure. 

From a network resilience perspective, overall network exposure 
increases the risk to reveal the critical actors for value chain survival, 
such as specialists from which multiple criminal value chains have 
become dependent. Because these specialists are underrepresented 
within the macro-network, these roles are hard to replace. Moreover 
replacing specialists demands direct interference of central brokers 
(coordinators) within the value chain, leading to even more exposure 
of these strategic network positions^. In this sense, our results indi- 
cate that network disruption causes these networks to become more 
efficient at first, but rather ineffective in the end as recovery forces 
them to light up more and more from the dark. 

This increased visibility might induce a serious change within 
agencies involved in contemporary law enforcement control of orga- 
nized crime, as new opportunities for surveillance and advanced 
intelligence gathering arise to identify and target more critical actors, 
specialists or even potential future replacements. With this strategy, 
the network resilience progressively declines and additional cracks 
within network structure will emerge in the long run, offering more 
specific disruption opportunities in the end. Our results emphasize 
the importance of considering these criminal network structures 
within their complex adaptive dynamics, instead of focusing on a 
snapshot of a group at a certain point in time. In practice this means 
that disrupting a criminal network demands a long-term consistent 
intervening effort. 

A popularized version of some of this research has been presented 
in a scientific documentary on Criminal Networks by the Dutch 
National TV network VPRO'^'. 
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